A858DE45F56D9BC9 archive

201208170348 yc0x0

explained decrypted filler

3DES(name+title) ECB, 38 GUIDs, seed 586

Metadata

Post ID
yc0x0
Title
201208170348 → 2012-08-17 03:48 on A858's clock
Posted (UTC)
2012-08-16 18:48:16
Timezone
UTC+9 · title 03:48 against posted 18:48 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170348) = 0ae92c02b6fcb9b0f27ed9e6ff61ce73 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
38
Filler GUID seed
new Random(586).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
18 · predicted N = 38 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

EA99E3BA0ADB9F53 98153570246DFFBC 48C6E5D59710BC12 A08B52B80C58BF69 116FD08C3A2BCF73 583E38018C2BFE6F 15AD396AD8B756E6 CC013A16F976E5BC CFEDA310577FB184 E0DBC4D8E0790D6B DC2E858A27EA298B 90C61F59CA072A5D CDA96BE31B81162B EA91AB290FE01311 7BB594C17D744E13 7D39ADF7476FAB22 AAB19310C8D50770 06F37CB6CA4CC33A D00DDDEF35DAE3B3 1F108BD4E21523AC FEDADC779F3ADA2F A6082E4253D49BBB 543AA41CFE089D14 16E9503BE8361354 183B93F1111FE483 071A0184739A5E2A 953E2DEB26A5B1AA 32E878DEAEE7F28F 2A14390CD8AC34F5 36DBEC36069B3071 DDC599FBE3BD74D1 300B037C0189AE6A FDC0E49DE33DA332 30D1B52BAF8F91C2 BF95B3B12ABE8E31 B3E03B85FE4137F4 94A86DFFD9464892 8A162BFD38723D91 4B11FFAA6886CA42 94EFF3018C9941E9 30BF6AB14BA5AF6A CDDA2538106CB3B8 C5F3F42BE575D424 7F397FCF90071EEA 07275AB71E2A2521 00AF2B296A5C858D CEC5DA4CCD3B1051 8318FAFD69BF31DF DCEEBD6F2C1A2E6F F52FCE81007FFC26 D016A222ABC91528 BA648AEEFDC1BCE0 B67515CAC725964D CE24DE8E749B9C31 33E477C424F5B3B5 48799ABE752B6BF5 A91F49992504ED2F 060C157E4BA7E60D D49446FFF5E8000C 6389FB8BFB1A5A97 5D5FB77C4FC180D0 A0A5E1B4C4A5C95F 71F1A033E8F8B159 A7A4978ACF8D3437 DFF56A9498586891 B55C7FCFF9BBAFAD 3DBED3E2F710E36C 26924DB652F0B7EB 6C3913ADD9CC2A69 9F7E622B40170D40 21BE0E6610AAC284 0313B73F65C1181B F509A29AB4D272F5 73B09C3FD60C568C C2768F42CDCCE7C8 BF45A49D50440F1A 374D7C21AE08B339 3F30F16248B4C339 7CD0A2F76A6E2027 AA85B22EC1E25BE7 7AA5D9DF9724D473 817F6CAD80C7CDB1 E3D0E74AFE9AD19D 68939BAEC70E5EC3 10D4F54E26D0929D 39DC6A7679F2E326 33D19B1E73514F1B 9168E5E76538A9F2 41D931EB0E0FA812 6E6A1310D3A2D5A3 33DAE46C74B6C4D4 63598443F4B00D17 C6AAE0B3CC41193B 059B7B4446713E56 7E1E2CBD1B086F0D 129807D302E91566 97148BBEEC90C46D C68C9EF43145973A 485DB248E07E15E0 DFFC8BC1E410765B 2835915AA0075CE3 24C5A45BA219B1C9 551C28CA8E27EA95 FC1CACDF4B3FC7EA 308DBB3FB9B83115 4480B842B4534634 E439AF39DC05EEF4 C4EC8BA9369214EF 4C77B480E7F3AA25 6094270059B86457 C24688FB86389171 7E0569FD60B848D1 A918D3DAE5FC5DD5 BA252B1EF4EA5720 7833DFC33E4BBC78 D743E983C3B6333F 8D50EA110406C970 21A7E8D9703416EC A4A1AC1F7F6DE326 1738E780A827C055 C8042C4EF484642F E97BC50FA06A88A8 FD6B343894683DD0 6CAA8B0E2DB65584 D5CB65DE53F49D99 59F96DA99EDF32CB 81C1E170D926A8C7 3A5CF55F3A08851E 3D18A63418A6C84A CE124B0F7243161E 411CFC4E33B79CE1 67B97577897E543E EA9E3ACF07BA4C23 8A53AE50F087F075 87DD515B8355AF87 403E68EAE81468F5 FE4597DE2C831030 252AA39DB122B4B6 B25C49833ADBDFD4 C466D32E5A729516 86967D577F828E32 64BBFC9EEEC07CC3 E8A18A03F2FA1985 FAC47B11941C6A33 E302CAB0181E96FF B55AF474560ACEF1 7FCAF2E58004680C 7D8C4D19A7345ACB 5EE518B503BD2F92 C97B826EEEA4B3A2 D26C13ED8F042872 D9D5C98984EC9B74 79C4738F7BD008DE
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170348 (name+title). Key = MD5(password) = 0ae92c02b6fcb9b0f27ed9e6ff61ce73, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0d497f18-1c5d-77ef-afe3-5278a3f5ec47
  2 0cb56ec6-570f-6004-bb16-8186f5fc0d47
  3 da883c1c-4ccc-3d13-83d6-afecc117308a
  4 c9b57183-9d6b-53ec-9441-04b2d252643a
  5 601ea20f-3c55-6f6f-88b5-fd51d00ae2cd
  6 99840d95-edfc-5103-aa29-e64cb34197c5
  7 680b4a07-b052-412a-b2c5-3888feed5c7c
  8 e83c335a-d1fc-3416-b3bf-a5946dfd2a91
  9 6e5f195c-dfbc-48b7-8e0a-83df7c9b4443
 10 28dbf08f-5797-305c-bab3-3dca3087b23d
 11 bdd25891-8d34-0273-96bb-4ff9b39f77aa
 12 766f4a22-af20-8a01-8d1f-61c2103c344d
 13 67745c4e-cc69-40e1-b9cc-9c5f053041ab
 14 468324b4-9f61-3b5c-996a-6983c31a316c
 15 26b8e228-cb91-1201-b888-bf921b62075b
 16 8b91cf24-71de-863f-902a-82aaed5390d7
 17 719e26e2-5e87-1185-b977-c2cd81b346ac
 18 4e7d1261-6768-2c31-ae66-19c5e6dc6afc
 19 05c4ccab-794c-47a8-96a4-7752c4746de4
 20 0e30a1a0-7fb6-1b71-8351-b56df3fa6b8f
 21 1eaaf70e-9aa4-691f-90d4-11ae519f8d01
 22 f0b6ef01-fc3d-5ad4-8401-cf2b1588ffa8
 23 a2536afc-0ee3-0e04-87b8-88d013c8035f
 24 2879e4b3-df07-6280-a5dd-4f7ba267f9f5
 25 ab3f6385-049a-1fbc-b3e7-0bf5ae5adf7e
 26 0b8ddae7-a634-3065-adb9-758bc053736c
 27 e059037e-2ec6-660d-9ff8-c76d97739239
 28 953fa3b2-0651-7ddb-b198-7bb564e92e4e
 29 140c033a-72fc-3f20-89c1-267e91100b71
 30 3455afc9-fa88-0521-9ad6-dd1da9e707ff
 31 164db0ad-7195-4bd3-9e08-1a7739cc763d
 32 9509daf3-1ca0-79ee-99bf-bb88a356fe6f
 33 7bebcaf2-eb36-8308-9a82-29b97cb6a070
 34 e805dbe6-6fc6-66a1-973b-97fe03880eef
 35 3085f586-063d-250d-9291-859d6380d19c
 36 b2013c86-b99c-1779-8c73-646093835c05
 37 a5eea13b-737e-3190-904f-66e045be091f
 38 408366cc-f1b6-62c4-8ca1-2015d44c00ea

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 76356543430843181241650613673047862136. Exactly this sequence comes out of new Random(586).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 18 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results